Analysis
- max time kernel
2377727s - max time network
173s - platform
android_x64 - resource
android-x64-arm64-20220310-en - submitted
15/03/2022, 13:11
General
- Target dcb88fb46c8d030c6f92dff0cd5e4c2f5bdf223070f2596c86a454f1adf00729.apk
- Size 2.0MB
- Sample220315-qe95gadbgr
- SHA256 dcb88fb46c8d030c6f92dff0cd5e4c2f5bdf223070f2596c86a454f1adf00729
Score
10/10
Malware Config
Extracted
Family
-
xenomorph
C2
-
simpleyo5.tk
-
simpleyo5.cf
-
kart12sec.ga
-
kart12sec.gq
Extracted
Family
-
xenomorph
Attributes
-
PackageNames
com.android.vending
com.google.android.gm
-
URLs
https://homeandofficedeal.com/local/multi/com.android.vending.html
https://homeandofficedeal.com/local/multi/com.google.android.gm.html
AES_key
AES_key
AES_key
Signatures
- Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
- Makes use of the framework's Accessibility service. 3 IoCs
- Acquires the wake lock. 1 IoCs
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
- Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.token.jewel1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).